Binance · Cryptocurrency security · Developing investigation
Binance is investigating a $6.3 billion incident. About $3 billion is frozen.
Binance’s October 30 statement estimates roughly $6.3 billion in affected assets, with approximately $3 billion frozen through partners. Its preliminary account points to a possibly compromised DevOps laptop and access to a service container that submitted unauthorized withdrawals. Later reporting describes additional possible entry points. The initial route is not a completed forensic explanation, and frozen assets are not automatically returned assets. The totals describe estimated impact and containment at a particular stage, rather than a final unrecoverable loss.
The latest Friday update says deposits are operating normally while withdrawals remain paused. Binance has promised to cover losses using its protection reserve and company funds; that is a commitment, not confirmation that every loss has already been reimbursed. TRM Labs separately traces approximately $6.36 billion across ten blockchains, most moved in around twenty minutes, and attributes the operation to North Korea’s TraderTraitor with high confidence. That remains the analytics firm’s attribution; Binance has not named a confirmed perpetrator in the reporting cited here.
Binance says it has found no evidence of wallet private-key leakage. That narrower statement does not establish that signing authority or the surrounding operational workflow was protected. The investigation needs to explain how unauthorized instructions became valid transfers and which independent controls failed. The incident illustrates the concentration of trust inside a large exchange even when the underlying ledger remains visible. The blockchain kept its record. The security team now has to establish who obtained authority to write the withdrawal instructions, and the recovery team has to turn freezes and promises into actual restitution.
Source: The exchange’s initial estimates and preliminary account ↗Source: Friday’s service status, developing scope and attribution limits ↗Source: The independently attributed on-chain investigation ↗
PHP2Shell · Palo Alto Networks · Active exploitation
The firewall was keeping watch. Its management page needed a lock of its own.
Palo Alto Networks’ October 29 update confirms active PHP2Shell exploitation against internet-exposed PAN-OS management interfaces. Unit 42 says it independently verified attacker tooling that chains the PHP weaknesses with a Linux privilege-escalation flaw to reach root. The two PHP issues, CVE-2026-109618 and CVE-2026-109619, were disclosed and patched upstream on October 21. The new development is confirmed exploitation of a protective platform, rather than a vulnerability discovered this morning. A service-level foothold and system-level control are different stages of the chain.
The populations also need separating. The vendor says approximately 0.02% of its global installed base had internet-facing management interfaces configured and were impacted, with those customers contacted. Its separate estimate of more than 22.6 million exposed instances potentially vulnerable to the PHP flaws describes a broader population, not millions of confirmed firewall intrusions. The advisory concerns the management web interface, including its HTTPS UI and XML API; GlobalProtect portal and gateway are outside this specific advisory. Those limits matter without making the confirmed attacks insignificant.
The vendor directs customers to remove public management access, restrict it to trusted sources and apply the appropriate branch-specific hotfixes. Internet exposure creates the greatest risk; keeping an interface internal reduces exposure while leaving patching necessary. Organizations also need to assess whether a device was already compromised. Protective infrastructure has powerful permissions of its own, so its administrative surface deserves the same care as the systems behind it. The firewall still has an important job. Its own front door cannot be exempt from the rules it enforces for everybody else.
Source: The affected management surface, active exploitation and fixed versions ↗Source: The verified chain and the two distinct exposure populations ↗
OpenAI · Anthropic · Formal mathematics
Two AI labs challenged a cornerstone of computing theory. The mathematicians want to inspect the map.
OpenAI’s October 26 release and Anthropic’s separate public repository claim algorithms contradicting the Exponential Time Hypothesis, or ETH. Roughly, ETH says that solving general 3-SAT formulas requires exponentially growing worst-case time as the number of variables increases. Think of many true-or-false switches constrained by clauses involving up to three literals. The question is whether any setting satisfies every clause. The labs claim subexponential algorithms, including methods for counting satisfying assignments, rather than simply a faster answer on a familiar benchmark.
If the claims withstand review, that would change an important assumption used throughout complexity theory. It would not establish P = NP or show that ordinary computers can efficiently solve every difficult real-world instance. Subexponential growth can still be enormous, and an asymptotic advantage may be practically inaccessible. Anthropic explicitly states that its result provides no practical solving claim. The two releases are also separate research artifacts, not one laboratory independently reproducing and certifying the other’s theorem.
Both publish Lean material alongside mathematical papers. Formal checking strengthens scrutiny of encoded statements, while the relationship between the formal statement and the intended theorem still needs expert attention. OpenAI named an external group led by Russell Impagliazzo, Ramamohan Paturi and Ryan Williams; participation should not be mistaken for completed endorsement. We have inspected the release descriptions and available artifact structure, not independently rebuilt or proved these results. The AI may have found a remarkable shortcut. Publishing the map gives mathematicians something concrete to test before everybody starts planning a journey along it.
Source: The announced result and external review approach ↗Source: The public OpenAI manuscript and formal artifacts ↗Source: The separate claim, formal correspondence caveat and practical limits ↗